January 2008 - Freeradius-Users - lists.freeradius.org

seg fault
by Joe Vieira 14 Jan '08

14 Jan '08

I've been trying to pin down a rather elusive segfault for over 2 months now. and i finally got it to happen inside of gdb. this is freeradius 1.1.6, on rhel5 x86-64 if this problem is fixed in 2.0 or 1.1.7 please let me know. Starting program: /usr/sbin/radiusd -X [Thread debugging using libthread_db enabled] [New Thread 46912543318400 (LWP 8450)] Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 46912543318400 (LWP 8450)] 0x00002aaaac1666d5 in _int_malloc () from /lib64/libc.so.6 * 1 Thread 46912543318400 (LWP 8450) 0x00002aaaac1666d5 in _int_malloc () from /lib64/libc.so.6 Thread 1 (Thread 46912543318400 (LWP 8450)): #0 0x00002aaaac1666d5 in _int_malloc () from /lib64/libc.so.6 No symbol table info available. #1 0x00002aaaac167d4d in malloc () from /lib64/libc.so.6 No symbol table info available. #2 0x00002aaaabe05102 in CRYPTO_malloc () from /lib64/libcrypto.so.6 No symbol table info available. #3 0x00002aaaabe2a6b7 in BN_free () from /lib64/libcrypto.so.6 No symbol table info available. #4 0x00002aaaabe2a808 in bn_expand2 () from /lib64/libcrypto.so.6 No symbol table info available. #5 0x00002aaaabe2abd5 in BN_bin2bn () from /lib64/libcrypto.so.6 No symbol table info available. #6 0x00002aaaabe36ea0 in RSA_PKCS1_SSLeay () from /lib64/libcrypto.so.6 No symbol table info available. #7 0x00002aaaabb7cc62 in ssl3_get_client_key_exchange () from /lib64/libssl.so.6 No symbol table info available. #8 0x00002aaaabb7ecaf in ssl3_accept () from /lib64/libssl.so.6 No symbol table info available. #9 0x00002aaaabb854c3 in ssl3_read_bytes () from /lib64/libssl.so.6 No symbol table info available. #10 0x00002aaaabb82431 in ssl3_renegotiate_check () from /lib64/libssl.so.6 No symbol table info available. #11 0x00002aaaae1d77da in tls_handshake_recv (ssn=0x555558718240) at tls.c:173 err = <value optimized out> #12 0x00002aaaae1d6ad5 in eaptls_process (handler=0x555559e07860) at eap_tls.c:638 tls_session = (tls_session_t *) 0x555558718240 tlspacket = (EAPTLS_PACKET *) 0x55555860bc80 status = EAPTLS_LENGTH_INCLUDED #13 0x00002aaaaebe642b in eappeap_authenticate (arg=0x5555584e9ac0, handler=0x555559e07860) at rlm_eap_peap.c:169 rcode = <value optimized out> status = <value optimized out> tls_session = (tls_session_t *) 0x555558718240 #14 0x00002aaaadfcf1c6 in eaptype_call (atype=0x5555584e7d50, handler=0x555559e07860) at eap.c:167 rcode = <value optimized out> #15 0x00002aaaadfcf30a in eaptype_select (inst=0x5555584d23d0, handler=0x555559e07860) at eap.c:361 default_eap_type = <value optimized out> eaptype = (eaptype_t *) 0x555559d5feb8 vp = <value optimized out> namebuf = "\000\000\000\000\000\000\000\000@ÒoXUU\000\000P®oXUU\000\000\237æüª*\000\000àßoXUU\000\000xF\035®ª*\000\000\000\000\000\000\000\000Ð\000XLwUUU\000" eaptype_name = 0x2aaaae1d7d26 "peap" #16 0x00002aaaadfcdffb in eap_authenticate (instance=0x5555584d23d0, request=0x555558609f90) at rlm_eap.c:261 inst = (rlm_eap_t *) 0x2aaaac442960 handler = (EAP_HANDLER *) 0x555559e07860 eap_packet = (eap_packet_t *) 0x0 rcode = <value optimized out> #17 0x0000555555563682 in modcall (component=0, c=0x5555584cfe30, request=0x555558609f90) at modcall.c:236 myresult = 0 #18 0x0000555555563c71 in call_one (component=-1404819104, p=0x80, request=0x55555860b0e0, priority=0x2aaaac442ad0, result=0x400000) at modcall.c:269 r = <value optimized out> #19 0x000055555556384c in modcall (component=0, c=0x5555584cfe80, request=0x555558609f90) at modcall.c:324 g = (modgroup *) 0x5555584cfe80 myresult = 0 #20 0x000055555555b763 in rad_check_password (request=0x555558609f90) at auth.c:380 dval = (DICT_VALUE *) 0x0 auth_type_pair = <value optimized out> cur_config_item = <value optimized out> password_pair = (VALUE_PAIR *) 0x0 auth_item = <value optimized out> string = "à[oÑÿ\177\000\000@foÑÿ\177\000\000\020ºUUUU\000\000\220÷VUUU\000\000ÀÜ:XUU\000\000LíVUUU\000\0008ö\a\000\000\000\000\000uest 521P\031OXUU\000\000ç6VUUU\000\000\220\237`XUU\000\000\000\020\000\000\002\000\000\000\200ázª*\000\000\000\000\000\000\000\000ÿÿö\003\000\000\030\000\000\000P(OXUU\000\000Ä\\oÑÿ\177\000\000À\\oÑÿ\177\000\000\001\000\000\000\000\000\000\000\220\237`XUU\000\000P\031OXUU\000\000q<VUUU\000\000P(OXUU\000\000P\031OXUU\000\000Ä\\oÑÿ\177\000\000"... auth_type = 6 result = <value optimized out> auth_type_count = 1 #21 0x000055555555bc8a in rad_authenticate (request=0x555558609f90) at auth.c:675 check_item = <value optimized out> vp = (VALUE_PAIR *) 0x55555860b0e0 namepair = (VALUE_PAIR *) 0x5555586c89d0 check_item = <value optimized out> reply_item = <value optimized out> auth_item = (VALUE_PAIR *) 0x0 module_msg = <value optimized out> tmp = (VALUE_PAIR *) 0x0 result = 3 r = <value optimized out> umsg = "P\"lXUU\000\000P\"lXUU\000\000\020\000\000\000\000\000\000\000³\004\026¬ª*\000\000Ø\237`XUU\000\000`\027D¬ª*\000\000<\000\000\000\000\000\000\000\n\000\000\000\000\000\000\000\000`¬ªª*\000\000Æ\003\026¬ª*\000\000\020\000\000\000\000\000\000\000`\027D¬ª*\000\000`\027D¬ª*\000\000\n\000\000\000\000\000\000\000ì,pXUU\000\000¡\2101«ª*\000\000P\035D¬ª*\000\000P\"lXUU\000\000\214\"lXUU\000\000ì,pXUU\000\000\020\000\000\000\000\000\000\0005´1«ª*\000\000Ø\237`XUU\000\000\000\000\000\000\000\000\000\000\020LiXUU\000\000"... user_msg = <value optimized out> exec_program = <value optimized out> exec_wait = <value optimized out> seen_callback_id = <value optimized out> buf = "fc4daac0ccb383c13719d6ce6b49e659e4ef4a89709757b2585190f69bb3d66c\030\000\000\0000\000\000\000ÀdoÑÿ\177\000\000\000doÑÿ\177\000\0000c69140301000101160301003074a66566d27123ef7e02bd329e6e670027d85e69ca060d2f22ca38b096596f7d3dc57f7230c750ff8a4c50"... logstr = "\020\000\000\0000\000\000\000\001\000\000\000\000\000\000\000\020\000\000\0000\000\000\000P`oÑÿ\177\000\000\220_oÑÿ\177\000\000ù\034¦N\bú\206\035/&ç°Q&\235½í©|ÉgÃ:Oê@è\004¤}éæþ·¤ó<?C\177³5ø\003y\206¿h¯\017\000\000\202\000\200 Ã\020ñû#ëÓ]iðÀ\030ÃÓBª{\000\tiÅ8\205\214Óä¹\227ôfq³\200wûä¶mª\0223¡,¥´Äq]?ïE\002/á\0013\020^oÑÿ\177\000\000\000\000\000\000\000\000\000\000OdoÑÿ\177\000\000P`oÑÿ\177\000\000P`oÑÿ\177\000\000p_oÑÿ\177\000\000"... autz_retry = <value optimized out> autz_type = <value optimized out> #22 0x0000555555564bfa in rad_respond (request=0x555558609f90, fun=0x55555555ba10 <rad_authenticate>) at radiusd.c:1669 rcode = 0 packet = <value optimized out> original = <value optimized out> secret = 0x555558609fd8 "stupid" finished = <value optimized out> reprocess = <value optimized out> #23 0x00005555555661d6 in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:1434 fun = (RAD_REQUEST_FUNP) 0x55555555ba10 <rad_authenticate> request = (REQUEST *) 0x555558609f90 packet = (RADIUS_PACKET *) 0x555558694c10 secret = (u_char *) 0x5555584cc6f8 "stupid" buffer = "10.13.13.13\000\000\000\000\000«HØ¼`\016a*ä2Ý«ª*\000\000ðwoÑÿ\177\000\000x²\r¬ª*\000\000\000\000\000\000\000\000\000\000àjoÑÿ\177\000\000\002\000\000\000\000\000\000\000°ioÑÿ\177\000\000\213}«ªª*\000\000\000¶uª¹\215ñ\016ìò*Ä\223v\001\001\200woÑÿ\177\000\000ðwoÑÿ\177\000\000p\215Ú«ª*\000\000\000\000\000\000\000\000\000\000ÀloÑÿ\177\000\000\a\000\000\000\000\000\000\000½`«ªª*\000\000\000\000\000\000\000\000\000\000`\215Ú«ª*\000\000\000\000\000\000\000\000\000\000¦}«ªª*\000\000\200woÑÿ\177\000\000"... readfds = {fds_bits = {128, 0 <repeats 15 times>}} argval = <value optimized out> pid = <value optimized out> max_fd = <value optimized out> status = <value optimized out> tv = (struct timeval *) 0x2 act = {__sigaction_handler = {sa_handler = 0x5555555649e0 <sig_fatal>, sa_sigaction = 0x5555555649e0 <sig_fatal>}, sa_mask = {__val = { 0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0} listener = <value optimized out> The program is running. Exit anyway? (y or n) Not confirmed. thanks, joe

3 4

me for help
by adnan deura 14 Jan '08

14 Jan '08

i get the following output after configuring mysql the file is attached please help _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

Hello, and a question.
by David W Bell 14 Jan '08

14 Jan '08

Hi there. Have used freeRADIUS in the past to authenticate dial-up/ADSL users, but now have a different implementation problem that requires some input from this list. I am working on a Single Sign-On solution to try and give users in the organisation that I work for, a single username and password. I am planning on using LDAP for the backend store, as a lot of our equipment can be configured to use LDAP natively. However we also have a lot of routers and other network kit that either talks RADIUS or TACACS+ (or both) I would like to keep things as simple as possible, so my question is. Can freeRADIUS provide everything that TACACS+ can so that I need only install/configure freeRADIUS. Thanks in advance David W Bell

3 3

help
by adnan deura 14 Jan '08

14 Jan '08

after all the installations and configurations what can i do with freeRadius as a student , i mean what to show to my teacher _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

Sample configurations file for Windows XP -PEAP(FreeRadius 2.0)
by nicknie 14 Jan '08

14 Jan '08

Hi All, I'm new to FreeRadius and want to test WIndoes PEAP with FreeRadius 2.0. The network diagram is: Windows XP----AP(with 802.1x proxy)192.168.1.10----FreeRadius 2.0(192.168.1.100) I want to have Windows XP station username/password in a file in Linux server. Anybody has a sample configuration file? Thanks Nick Nie

2 1

help
by adnan deura 14 Jan '08

14 Jan '08

please send me db_mysql.sql file _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

Problem with rlm_perl module
by serelk 14 Jan '08

14 Jan '08

Hello All I have spent few days trying to build freeradius with rlm_perl module on Solaris 10. Using both last versio 2.0.0 and 1.1.7 I'm getting vary similar problem. Does anybody get it running ? recvfrom 0x4814 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) socketpair 0x4a10 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(util.o) socketpair 0x6be4 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) getservent 0xdfbc /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) connect 0x7108 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) setservent 0xe2e4 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) getnetbyaddr 0xd9b8 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) getprotoent 0xdc90 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) getnetbyname 0xd93c /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) setnetent 0xe214 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) getservbyport 0xdfac /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) getprotobynumber 0xdc80 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) endservent 0xe460 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) getprotobyname 0xdc38 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) setprotoent 0xe27c /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) endprotoent 0xe3f4 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) __muldi3 0x5bbc /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(perlio.o) __divdi3 0x5bb0 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(perlio.o) __floatdidf 0x597c /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) __floatdidf 0x5bbc /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) __floatdidf 0x5cd8 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) __floatdidf 0x8320 /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) __floatdidf 0x8eec /usr/local/lib/perl5/5.8.8/sun4-solaris/CORE/libperl.a(pp_sys.o) ld: fatal: relocations remain against allocatable but non-writable sections collect2: ld returned 1 exit status gmake[6]: *** [rlm_perl.la] Error 1 gmake[6]: Leaving directory `/opt/OPEN-Ldap/freeradius-server-2.0.0 /src/modules/rlm_perl' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/opt/OPEN-Ldap/freeradius-server-2.0.0 /src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/opt/OPEN-Ldap/freeradius-server-2.0.0 /src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/opt/OPEN-Ldap/freeradius-server-2.0.0/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/opt/OPEN-Ldap/freeradius-server-2.0.0/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/opt/OPEN-Ldap/freeradius-server-2.0.0' make: *** [all] Error 2 Br Serelk

1 0

SQLippool problems (duplicate IPs handed out).
by Dave 14 Jan '08

14 Jan '08

I use the sql IP pool setup with mysql, and been using it fine for a while, but I have a problem where if I have an influx of connections at one time (30++) That freeradius will hand out an IP to my NAS, but it doesnt get written to the database fast enuff and another thread of freeradius hands out the same IP to another user, and logs that entry to the radippool table. So I get users with duplicate IP addresses.. this never happens if the connections are coming in slow enough, (1 or 2 at a time). freeradius 1.1.6 with mysql 5.0.26. Here is my sqlippool.conf. ---------------------------------------------------------------------------------------------------------------------------- sqlippool { ## SQL instance to use (from sql.conf) sql-instance-name = "sql" ## Table to keep ippool info ippool_table = "radippool" ## lease_duration. fix for lost acc-stop packets lease-duration = 3600 ## Attribute which should be considered unique per NAS ## Using NAS-Port gives behaviour similar to rlm_ippool. Calling-Station-Id is for NAS that send fixed NAS-Port pool-key = "%{NAS-Port}" # pool-key = "%{Calling-Station-Id}" ## Logging configuration. sqlippool_log_exists = "Existing IP: %{reply:Framed-IP-Address} \ (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "Allocated IP: %{reply:Framed-IP-Address} from %{check:Pool-Name} \ (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "Released IP %{Framed-IP-Address}\ (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "IP Allocation FAILED from %{check:Pool-Name} \ (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "No Pool-Name defined \ (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" # ## This series of queries allocates an IP address # allocate-clear = "UPDATE ${ippool_table} \ # SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ # expiry_time = '0000-00-00 00:00:00' \ # WHERE pool_key = '${pool-key}'" ## This will clear all expired leases for lost acc-stop packets allocate-clear = "UPDATE radippool \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time = '0000-00-00 00:00:00' \ WHERE expiry_time <= NOW() - INTERVAL 1 SECOND" # ## The ORDER BY clause of this query tries to allocate the same IP-address # ## which user had last session... allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ WHERE pool_name = '%{check:Pool-Name}' AND expiry_time < NOW() \ ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time \ LIMIT 1 \ FOR UPDATE" ## If you prefer to allocate a random IP address every time, use this query instead #allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ # WHERE pool_name = '%{check:Pool-Name}' AND expiry_time = '0000-00-00 00:00:00' \ # ORDER BY RAND() \ # LIMIT 1 \ # FOR UPDATE" ## If an IP could not be allocated, check to see if the pool exists or not ## This allows the module to differentiate between a full pool and no pool ## Note: If you are not running redundant pool modules this query may be commented ## out to save running this query every time an ip is not allocated. pool-check = "SELECT id FROM ${ippool_table} WHERE pool_name='%{check:Pool-Name}' LIMIT 1" allocate-update = "UPDATE ${ippool_table} \ SET nasipaddress = '%{NAS-IP-Address}', pool_key = '${pool-key}', \ callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', \ expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE framedipaddress = '%I'" ## This series of queries frees an IP number when an accounting ## START record arrives start-update = "UPDATE ${ippool_table} \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}'" ## This series of queries frees an IP number when an accounting ## STOP record arrives stop-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time = '0000-00-00 00:00:00' \ WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" ## This series of queries frees an IP number when an accounting ## ALIVE record arrives alive-update = "UPDATE ${ippool_table} \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" ## This series of queries frees the IP numbers allocate to a ## NAS when an accounting ON record arrives on-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time = '0000-00-00 00:00:00' \ WHERE nasipaddress = '%{Nas-IP-Address}' AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" ## This series of queries frees the IP numbers allocate to a ## NAS when an accounting OFF record arrives off-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time = '0000-00-00 00:00:00' \ WHERE nasipaddress = '%{Nas-IP-Address}' AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" } ----------------------------------------------------------------------------------------------------------------- Anyone have any ideas? Thanks

3 3

help again
by adnan deura 14 Jan '08

14 Jan '08

if the website is old where should i go buddy http://www.aerospacesoftware.com/radius.html ? _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

3 2

help
by adnan deura 14 Jan '08

14 Jan '08

please help! i have to install freeRADIUS 1.1.7 on fedora core 7 ,but i am unable to add users to the 'users' file . i am getting help from the website : www.aerospacesoftware.com/radius.html i add the user in this way, johndoe Auth-Type := Local, User-Password == "johndoepassword" Reply-Message = "Hello, %u" AND AFTER THAT # radiusd -X# radtest johndoe johndoepassword localhost 1812 yoursharedsecret BUT THE RESPONSE FROM THE SERVER IS NOT "rad_recv: Access Accept packet...". BUT "rad_recv: Access-Rejected packet...". please tell me what to do should i install an older version ? _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

3 2